Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
0
votes
1answer
31 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
2
votes
1answer
52 views

Is there more than one public key for a private key?

Does deriving the public key from an RSA private key always yield the same result? And if so, does this generally apply to all asymmetric cryptosystems?
1
vote
2answers
60 views

Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
1
vote
0answers
35 views

Key derivation scheme with shared secrets?

I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
5
votes
1answer
324 views

Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?

See this answer that explains the following sequence of operations: CipherText = IV|| AES(key1,iv,message) tag = hmac(key2,ciphertext) That answer says, You ...
1
vote
1answer
48 views

Station-to-Station protocol questions

Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys. Alice sends Bob her public key $A_K$ Bob receives $A_K$ and computes ...
1
vote
0answers
35 views

RSA Modulus doesn't match the primes [closed]

I generated a 2048-bit RSA key with ssh-keygen. When running: openssl rsa -in key -noout -text The result is: ...
0
votes
1answer
82 views

Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
4
votes
2answers
123 views

Key derivation on Arduino

The ATmega2560 is slow - it's a single core, 16MHz 8-bit AVR. Despite that, I need to use some encryption on it, and since it is limited to a few blocks, AES-256 can be used. However, the key ...
2
votes
2answers
146 views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
0
votes
0answers
25 views

Rekeying procedure - how “far” from bijection?

Imagine that I want to change the key in order to prevent side-channel attacks on key and to protect against big load on the one key. It is desirable that key change procedure would look like random ...
2
votes
2answers
75 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "slow" memory. The ...
4
votes
3answers
959 views

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity). Here is how my encryption scheme is: ...
31
votes
6answers
4k views

What is the practical impact of using System.Random which is not cryptographically random?

I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was ...
2
votes
3answers
164 views

Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?
2
votes
1answer
70 views

What is a randomly derived key?

It is a well-known fact that using the same key + nonce combination with a stream cipher twice breaks security. The NaCl library has different primitives for authenticated encryption (i.e., ...
2
votes
1answer
88 views

Are two keys derived from the same password vulnerable to a related key attack?

Background I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not ...
1
vote
2answers
71 views

“Dave Check” for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
2
votes
1answer
59 views

Is it safe to reuse the salt for generating symmetric keys for a chat application?

I'm writing a program that allows two users to communicate over E2E encrypted chat with a secret they have agreed upon in the past. The process works as follows: A key is derived from the secret ...
2
votes
1answer
41 views

AES key schedule. Does it use a KDF to generate the round keys?

So for each round in AES a different key is used, and as I saw the keys are created form a master key. My question is how these round keys are generated. Are they created via a Key Derivation ...
0
votes
0answers
49 views

Are two halves of PBKDF output “related” [duplicate]

In other words, in the context of authenticated encryption using Encrypt-Then-MAC, is this stupid?: ...
0
votes
0answers
28 views

ECDHE Key with KDF Necessary [duplicate]

Is it necessary to pass a ECDH generated key to a KDF? According to the python cryptography documentation, it is stated that For most applications the shared_key should be passed to a key ...
0
votes
0answers
57 views

Generating the Backup Exec AES-256 GCM key used to encrypt/decrypt LTO5 tape drive data

I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption ...
1
vote
0answers
58 views

I need to send 16 bytes using ECC keys on a resource-constrained device

I have a system where a resource-constrained device has to send 16 bytes. It has its ECC key pair, and a peer's Public ECC Key. We're using the p256 curve. The device also has an AES-128 hardware ...
1
vote
1answer
65 views

Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256

I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial ...
0
votes
0answers
18 views

Off-Chain Channel With Multi Participants That Have Different View/Write Access

I'm looking to expand my blockchain ability to have off-chain channels between different participants (let's say more than 2 participants). The requirements: Only the participants of the channel ...
3
votes
1answer
70 views

Bluetooth Low Energy: Key generation

I'm studying the BT core spec v5.1 to understand the security features and how everything fits together. I am looking at Secure Connections for now. In the field "Key generation" it says it uses P-...
1
vote
2answers
49 views

Derive operations from an arbitrary number

I don't really know how to phrase this question, so I'll just mention the idea. This is partially reminiscent (at least in spirit to white box crypto): Can one derive arithmetic operations from a ...
1
vote
1answer
49 views

how are variable key sizes produced?

I am current learning the internal working of several Symmetric key Cryptographic algorithms, and came across DES and AES. DES takes in input a 64 bit key and AES-128 takes in input a 128 bit key ...
0
votes
0answers
57 views

Can I use XOR to establish a longer shared secret?

SIKEp434 can only be used to encapsulate a 16 byte (128 bit) shared secret key. Most encryption algorithms these days (specifically (X)ChaCha20) require a 256 bit key to be secure, especially in a ...
6
votes
2answers
252 views

Do you really need a KDF when you have a PRF?

My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo ...
3
votes
2answers
144 views

Hashing a hash for authentication

I currently use Argon2 to derive a key (I will use a salt which I will save in a file as plaintext for when I later need to derive a key again) from a given password which I will use to encrypt a file ...
0
votes
0answers
28 views

Key Value Based Key Derivation

For a system that is using public key cryptography to authenticate users and their actions I'm trying to solve (ease) UI/UX problem so that users will be able to use login/passwords they're accustomed ...
2
votes
2answers
411 views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
2
votes
2answers
125 views

PBKDF and Entropy

We all regularly use password based, key derivation functions, however something that strikes me as counter intuitive is how PBKDF can somehow "stretch" the entropy of a supplied password to generate ...
0
votes
1answer
264 views

Is the KDF pbkdf2 included in the openssl suite? [closed]

I'm trying to encrypt a file using DES in CBC mode but when I try to specify the key derivation function it tells me my command is wrong. It only fails when I try specify the KDF and works when I don'...
-1
votes
2answers
64 views

Can modern password hashing functions mathematically exclude parallel computation?

A recent password hashing competition set out the following detailed technical requirement:- that the API should include, but may not be limited to, a function with the following prototype: <...
1
vote
1answer
80 views

Signal Protocol - Counter over TCP?

Signal Protocol uses a counter (discussed in DoubleRatchet documentation) to define how many times KDF has derived a new key (aka a KDF step) which is then sent along with every message for the end ...
3
votes
1answer
244 views

How will be cipher selected when client is running on version TLS 1.3 and server is running on TLS 1.2?

How will be cipher selected when a client is running on version TLS 1.3 and server is running on TLS 1.2? The cipher list provided by TLS 1.3 client will be different than the version supported on ...
1
vote
0answers
65 views

How to implement correctly a “secure” authentication protocol? [closed]

Due to my lack of knowledge in this matter I am facing some problems to identify which features are sign of a bad implementation of a symmetric authorization application. As I am concerned the system ...
2
votes
1answer
76 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
0
votes
1answer
60 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
2
votes
3answers
170 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
1
vote
0answers
89 views

Strongswan KDF Test

How can a KDF implementation for IKEv2 application, specifically in strongswan implementation case can be verified for conformance with NIST SP800-135, please? SP800-135 KDF recommendation further ...
2
votes
1answer
74 views

How do i approach file encryption using encrypt-then-mac? [duplicate]

I'm programming a cryptographic application that encrypts files, locked with the password the user supplies. It's not intended to be used in production. It's a project for me to learn more about ...
6
votes
0answers
335 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
1
vote
1answer
68 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
3
votes
2answers
179 views

How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key. I use Linux, I am not sure which sources of ...
4
votes
1answer
295 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
3
votes
1answer
133 views

Using a KDF (PBKDF2) properly

I am new to crypto. I have a password for my user, e.g. &&38:while:HAVE:havana:60&& I want to encrypt several documents with 10 pages each with AES....